121 matches found
Fedora Update for rubygem-actioncable FEDORA-2019-1cfe24db5c
The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ruby On Rails - DoubleTap Development Mode secret_key_base Remote Code Execution (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ruby On Rails DoubleTap Development Mode secretkeybase Vulnerability', 'Description' = %q This module exploits a vulnerability in Ruby on Rails. ...
Ruby On Rails DoubleTap Development Mode secret_key_base Remote Code Execution Exploit
This Metasploit module exploits a vulnerability in Ruby on Rails. In development mode, a Rails application would use its name as the secretkeybase, and can be easily extracted by visiting an invalid resource for a path. As a result, this allows a remote user to create and deliver a signed...
Ruby On Rails DoubleTap Development Mode secret_key_base Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ruby On Rails DoubleTap Development Mode secretkeybase Vulnerability', 'Description' = %q This module exploits a vulnerability in Ruby on Rails. ...
DEBIAN-CVE-2019-5420
A remote code execution vulnerability in development mode Rails 5.2.2.1, 6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit...
Immunity Canvas: RAILS_ACTIVESTORAGE_RCE
Name| railsactivestoragerce ---|--- CVE| CVE-2019-5420 Exploit Pack| CANVAS Description| Ruby on Rails Arbitrary Deserialization RCE CVE-2019-5420 Notes| CVE Name: CVE-2019-5420 VENDOR: Rails NOTES: The vulnerability resides in the ActionStorage component of Ruby on Rails due to insufficient...
CVE-2019-5420
CVE-2019-5420 affects Ruby on Rails in development mode where the secret token used to secure sessions is guessable, enabling potential RCE via Rails internals. Connected exploits demonstrate deserialization/RCE vectors dependent on a guessed development secret base. Vulnerable condition: running...
CVE-2019-5420
A remote code execution vulnerability in development mode Rails 5.2.2.1, 6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit...
CVE-2019-5420
creationtimestamp| type| source ---|---|--- 2019-03-24 00:55:47+00:00| published-proof-of-concept| https://t.me/thebugbountyhunter/2446 2019-05-01 13:45:07+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/railsdoubletap.rb 2019-05-02...
Exploit for Path Traversal in Rubyonrails Rails
Rails-doubletap-exploit RCE on Rails 5.2.2 using a path trave...
Exploit for Command Injection in Rubyonrails Rails
CVE-2019-5420 CVE-2019-5420 Ruby on Rails For educational p...
CVE-2019-5420
A remote code execution vulnerability in development mode Rails 5.2.2.1, 6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit...
Possible Remote Code Execution Exploit in Rails Development Mode
There is a possible a possible remote code executing exploit in Rails when in development mode. This vulnerability has been assigned the CVE identifier CVE-2019-5420. Versions Affected: 6.0.0.X, 5.2.X. Not affected: 5.2.0 Fixed Versions: 6.0.0.beta3, 5.2.2.1 Impact ------ With some knowledge of a...
Ruby On Rails DoubleTap Development Mode secret_key_base Vulnerability
This module exploits a vulnerability in Ruby on Rails. In development mode, a Rails application would use its name as the secretkeybase, and can be easily extracted by visiting an invalid resource for a path. As a result, this allows a remote user to create and deliver a signed serialized payload...
CVE-2018-5420
This CVE entry is rejected; it does not represent an active vulnerability.
Moderate: Red Hat Security Advisory: httpd24 security, bug fix, and enhancement update
An update for httpd24-httpd, httpd24-nghttp2, and httpd24-curl is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...
Security Bulletin: IBM Flex System Manager (FSM) is affected by multiple cURL/libcURL vulnerabilities (CVE-2016-5419, CVE-2016-5420, CVE-2016-7141)
Summary Multiple security vulnerabilities have been identified in cURL/libcURL that is embedded in IBM FSM. This bulletin addresses these issues. Vulnerability Details CVEID: CVE-2016-5419 DESCRIPTION: cURL/libcURL could allow a remote attacker to bypass security restrictions, caused by the failu...
CVE-2017-5420
CVE-2017-5420 affects Mozilla Firefox prior to version 52.0 (and Firefox ESR up to 45.x); a javascript: URL loaded by a malicious page can obfuscate the address bar, enabling spoofing of an existing page while the malicious page’s address is not shown. The issue is documented as a content spoofin...
CVE-2017-5420
A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an attacker to spoof an existing page without the malicious page's address being displayed correctly. This vulnerability affects Firefox 52...